Potentially Suspicious Mofcomp Execution

Title: Potentially Suspicious Mofcomp Execution
Status: test
Description:Detects execution of the "mofcomp" utility as a child of a suspicious shell or script running utility or by having a suspicious path in the commandline. The "mofcomp" utility parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Attackers abuse this utility to install malicious MOF scripts
References:
  -https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
  -https://github.com/The-DFIR-Report/Sigma-Rules/blob/75260568a7ffe61b2458ca05f6f25914efb44337/win_mofcomp_execution.yml
  -https://learn.microsoft.com/en-us/windows/win32/wmisdk/mofcomp
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-12
modified:2026-08-06
Tags:

• -'attack.stealth'
• -'attack.t1218'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\mofcomp.exe' OriginalFileName:'mofcomp.exe'   selection_case:
    - ParentImage|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wsl.exe'
      - '\wscript.exe'
      - '\cscript.exe'
    - CommandLine|contains:
      - '\AppData\Local\Temp'
      - '\Contacts\'
      - '\Favorites\'
      - '\Favourites\'
      - '\Music\'
      - '\Pictures\'
      - '\Users\Public\'
      - '\Videos\'
      - '\WINDOWS\Temp\'
      - '%appdata%'
      - '%temp%'
      - '%tmp%'
  filter_main_wmiprvse:
    ParentImage: 'C:\Windows\System32\wbem\WmiPrvSE.exe'
    CommandLine|contains: 'C:\Windows\TEMP\'
    CommandLine|endswith: '.mof'
  filter_main_installutil:
    ParentCommandLine|endswith: '\InstallUtil.exe /Uninstall C:\Windows\CCM\Microsoft.ConfigurationManager.SVProvider.dll'
    ParentImage|endswith: '\InstallUtil.exe'
    CommandLine|contains|all:
      -'C:\Windows\TEMP'
      -'.tmp'

  filter_optional_null_parent:
    ParentCommandLine: 'None'
  condition:all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
Falsepositives:
  -Unknown
Level: high